Messages

Hi, you may have reached a point where you have set up a DNS server, but now need to make sure it is THE DNS server for your network.

Clients such as browsers and phones now come standard with the means to bypass your DNS server.

Originally, one would just block port 53
Now, we can redirect requests destined to the internet, back to localhost port 53 UDP, and TCP while we're at it.

Unfortunately, there are now more protocols on which to acquire DNS information.

You have to block 853, for DNS over TLS.
You cannot redirect 853 since unbound does not natively provide DNS over TLS.

That further closes the loop, however, now we have the problem of having DNS over HTTPs, web servers that respond to DNS-like queries.

Back then we could use a proxy, but now you can grab external block lists to just block reaching a server that provides any form of DNS request.
There are block lists at the IP firewall level, and DNS block lists, there is a built in list available in that screen you attached, in the category "Hagezi Targeted Lists", select "DoH/VPN/TOR/Proxy Bypass".

I got my initial redirect and block ideas from the earlier parts of this thread.

https://forum.opnsense.org/index.php?topic=9245.0

Throughout the thread, you will see various solutions, including from yours truly, on how to mitigate blocking of alternate DNS services for untrusted clients.
If you want to test if your current block lists are working, you may need to shut off a feature like this, as attached, on the browser you use.
Also make sure your computer is pointing to your firewall as the DNS server.

Cheers

Some ISPs, for example, Comcast/ Xfinity, and using their router box in bridge mode, very much dislike seeing altered frame priority set at the interface level. I learned that the hard way. If you're using your own cable modem, less issues.

I opted instead for simpler traffic shaping at the Layer 2 IP level for traffic that needs lesser priority.

I use a combination of hagezi and the windowsspyblocker lists.  You can get lists that work at both DNS and IP level of blocking,  and only allow windows updates without windows spy and  telling on you.

I did manually add some additional hosts on top of these lists such as the unique ID blocking for good measure, just enough before other functions like the store, begin to break. It is good to know those hosts in case I do want to break the store purposely.

Hi,

I'm also wondering, if this is possible or not (in pfSense it is not it seems). I just got the task to evaluate OPNSense and this is more or less a show stopper, if not possible to e.g. allow only MS Updates based on wildcard DNS:
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-connection-from-the-wsus-server-to-the-internet

http://windowsupdate.microsoft.com
http://*.windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://*.update.microsoft.com
https://*.update.microsoft.com
http://*.windowsupdate.com
http://download.windowsupdate.com
https://download.microsoft.com
http://*.download.windowsupdate.com
http://wustat.windows.com
http://ntservicepack.microsoft.com
http://go.microsoft.com
http://dl.delivery.mp.microsoft.com
https://dl.delivery.mp.microsoft.com

Windows update here only as an example (could use WSUS), but also other use cases where need to allow CDN type *.domain.com

Edit: if not out-of-the-box possible, would it be possible to use cron and dnsmasq to poll through a list say once an hour (if that wildcard doesn't need to be resolved real time) and then use that IP list in an alias or similar?

Remember the firewall deals with ghosts at the IP level. The convenience of using a host alias to resolve into an IP address is courtesy of opnsense, not necessarily the PF system.

You can bulk load host names into the alias by turning the tags into text. The number of hosts is finite, correct? It is better to have an accountable list so you know who can access your network. If we trusted any host from a domain that could allow some exotic spoofing.

It's not that hard, and the framework already does the heavy lifting of resolving them for you. I do something similar, including a use of dynamic DNS for most clients. I still have to set each site up and add the host in the respective alias. I wish my sites were as numerous as yours to have this problem haha. Hire more people to manage the access of your sites.

You can alternately allow a whole ASN have access, especially if an ISP is common amongst several clients. You can confine the access to a time interval so it is not open when unnecessarily, if the use case permits.

I did not know that the date is a link, thanks

That's good to know about the OISD lists, thank you

A lot of the stock Block lists that can be loaded on OPNsense, should do a normal amount of blocking.
Loading too many Advertisement related block lists will begin to break your experience on the internet.

I choose all the general lists except for AdGuard, specifically because it will break some streaming, and perhaps, in your case, gaming.
Anything higher than Hagezi's PRO list will break stuff, as mentioned on their website https://github.com/hagezi/dns-blocklists
I have the OISD big block list for myself, which has some Ad blocking, but for clients, I just choose the NSFW list.
For the Hagezi targeted lists, all except for: Safesearch (though this could be good for kids), Badware Hoster.

I load a ton more via custom URL lists, but don't want to be overwhelming to begin with.

Sadly, too much Ad blocking also breaks a lot of those sponsored websites on the top of [your favorite search engine] your search results.
It gets angry people since most people are used to clicking on the first result, past the unrequited AI sputter.

Hope that helps, I'm happy with using Unbound, but the system is flexible to offload to a separate PI project.

It's possible your client was using its own DNS services. Browsers tend to try using their own DNS these days out of the box.

I posted toward the end of this thread, which is admittedly, a bit complicated, but mainly involves the part you're asking about, the circumvention.

With a few choice aliases loaded from URLs, it will populate with CIDR blocks of servers that are known by their sources, that are known to host DNS services of classic and modern types (UDP, DoH, DoT, etc).

The easiest part is blocking port 853 UDP and TCP.
The second easy part is redirecting UDP 53 back to the Firewall or other local DNS server.
A rule using the specified aliases, will reduce the chances devices will reach a server via HTTPs or TLS.

It isn't perfect, but keeps devices (iOS, Android, ChromeOS) and browsers from reaching DNS via alternate means.

https://forum.opnsense.org/index.php?topic=9245.150

Love

A3

I have not seen ONE installer that cares about disk partition alignment, and they all tend to default to 8 byte alignment.

This part is complicated, and probably the huge reason I avoid installing from ISO unless a lot has changed across releases.

In a VM environment:

Install normally like I described above.

- Prepare a normal OPNsense installation as I described above, installed in a VM, to a VDisk of 14GB
- Confirm in /etc/fstab, that the only mountpoint is correctly using the GPT label, instead of block device:
  NO:  /dev/vt...p1 OR /dev/ada0p1 ... ...
  YES: /dev/gpt/efiboot0    /boot/efi msdosfs    rw    2    2
- prepare another Vdisk, partition with gdisk. I usually use a Linux-based distro, the utilities on them tend to not get in my way when partitioning.
- Start the first partition, EFI type, at 1MB into the disk, with size 255MB.
- Create a 2nd partition, FreeBSD-pZFS type (a504 on gdisk), size of about 15GB.
  - @nero355 It will start Aligned at 256MB.
- Still in Gdisk, Copy the names of the original partitions, efiboot0 and zfs0, respectively.
- I don't think FreeBSD cares about the File system labels as much as a Linux-based distro might.
- Format the EFI partition, mount both original and new EFI partitions, copy the contents of the original, over to the new one.
  - I even add a separate installation of Memtest86+ with grub, attached with various menu options and serial output for headless firewalls.
- dd the original ZFS partition, over to the new one.
- Disconnect both Vdisks, and start the VM with the Newly created Vdisk.
- Use zpool -e zOPN /dev/vtblk0p2 to expand the ZFS pool to use the remaining space above the original 14GB.

Customize your VM Firewall as much as you need, to avoid repeat work for multiple deployments

compress the image, and now you have an aligned image, ready for deployment of course in the config, replace references to vtblkX to ataX/nvmeX, and vtnetX... to igbX etc, that way the newly deployed hardware starts up with the correct interfaces ready to go. You can use the same EFI partition to store some configs from a more familiar OS to you, log into the console, copy the config.xml to /conf and reboot immediately.

If you booted into the USB through the CSM, it would make sense the installer would format the system meant to start the same way. The UEFI boot method has worked fine for me these past several releases.

I tend to shut off the CSM completely, disable secure boot and format the USB for strictly booting in UEFI mode.

In the installer, I think I chose the option ZFS UEFI Mode, no hybrid. It may be an advanced option. I also opt out of creating a swap partition. I haven't installed from ISO in a while since I setup the system in a VM and upgrade it there. Afterward, I use DD to put the the working system to a new disk and resize.

Aside from the monitoring tools, there is the scheduler, which can be instructed to run SMART short and long tests, on maybe weekly and monthly intervals, respectively.

In the event of drive failure. I have the most recent backup of the config.

On external disks, I carry a bootable Linux distro, and use it to deploy images to servers and firewalls. In the case of Opnsense, I have images created from pre-configured VMs, meant to cover 80% of most needs for a new site.

I use dd to the block device. after it's done, I resize the main partition, mount the EFI partition, drop the backup config in a directory.

Reboot to the deployed system, run:
zpool online -e nameOfPool /dev/adaXXX
to instruct ZFS to fill the remainder of the disk.

Make a copy of the config and do a search and replace of the interface device names from the virtualized to the real cards, like vtnet0 to igb0 for example. Copy the config over to /conf/config.xml, and immediately reboot, or with init 6 or your preferred method.

It's the quickest way to cover most disasters, of course the are more tools like HA (High Availability) to get a few firewalls running , with one of those acting as a spare to the other.

It doesn't hurt to have spare units with at least 4 ethernet ports, and spare SSDs on hand. I don't bother deploying images onto them until it's necessary.

The dd tool is fast enough, and the steps above can get you a working firewall within the hour.

It's easier to clone systems with a config and images kept up to date, it makes the hardware more easily replaceable when it fails.

cheers

Hi , yes great question, the Roku devices try to connect to IPs belonging to Oracle ASNs for telemetry services. The bonus is by blocking these, it also blocks telemetry attempted to be sent by an app or two on my and/or partner's phones.

I think these fields appeared more recently in recent production releases.

It should give more granularity. This could be useful, perhaps download one copy often, and distribute to client firewalls via an internal web server.

Classically, I update all aliases with a Cron Job on a weekly basis. It's only to make sure my URL sources do not ban me for getting too often.

If you want to shut down more of its telemetry, shut down access to Oracle related networks.

Do a lookup with a tool like
https://hackertarget.com/as-ip-lookup/

search for oracle

and load them into an alias, and make a  Floating rule using the alias as destination.

You'll see a little more getting blocked than you think. It breaks WebEx, but I don't trust Oracle at all.